Afrihost and Mailservers

Hi everyone,

A lot of clients have asked us this - the easiest solution would be to use SSL (port 465) for sending mail. It's very easy to set this on your mail client and you should be good to go.
 
Had exactly the same issue. Couldn't connect to my own private smtp server ( mx points to a dyndns - server is on a WA dsl line).
Other smtp servers worked - even saix, not that I could send, but a telnet session on P25 i got at least an answer back.
But not from my own.

Reboot of the router and everything worked again.
Strange.
 
RavenServers said:
Hi everyone,

A lot of clients have asked us this - the easiest solution would be to use SSL (port 465) for sending mail. It's very easy to set this on your mail client and you should be good to go.
Click to expand...

A lot of clients would rather use their own server so they can send from where ever they are on whatever network they may be useing....
 
Grand. Sitting here in the morning trying to fixing something that is NOT MY problem. :mad:

Logged at ticket yesterday already. Reply:
Which SMTP server are you referring to?
Port 25 is not blocked on the Afrihost ADSL service/network.
Click to expand...

I disputed it and proved it is being blocked. Reply
I have asked one of our server administrators to assist.
I will let you know what they say.
Click to expand...

Reply later:
This connection is probably hitting the SMTP spambot blocking system. If they
are unable to locate the problem on their network they should switch to port
587.

Please advise accordingly.
Click to expand...

Taurus Extrectum jumps to mind. Connecting from a dynamic IP (Afrihost assigned) to a server not in an RBL and not blocked on the other end, proves this wrong.

Now here is the joke. I manage the mail server I'm trying to connect to. It's not on an RBL and hasn't been.

Yet, now to satisfy some illogical reason, I have to change ports, switch all my clients, alternatively punch another hole into my firewall ... I think not.

Something is broken and somebody is not admitting it. Not new either: http://forums.pcformat.co.za/viewtopic.php?f=25&t=36257&start=30 - Posted: Mon Nov 16, 2009 8:42 am

No working:
~# tcptraceroute XXXXXXXXXXXX.net 25
Selected device eth0, address 10.0.0.250, port 48469 for outgoing packets
Tracing the path to XXXXXXXXXXXX.net (41.223.60.X) on TCP port 25 (smtp), 30 hops max
1 10.0.0.2 0.762 ms 0.699 ms 0.807 ms
2 196-210-140-129-rrdg-esr-2.dynamic.isadsl.co.za (196.210.140.129) 7.154 ms 6.294 ms 7.383 ms
3 cdsl2-rba-vl2663.ip.isnet.net (196.38.73.25) 9.066 ms 9.605 ms 9.319 ms
4 cdsl1-rba-vl11.ip.isnet.net (196.38.73.37) 9.277 ms 9.300 ms 9.075 ms
5 196.38.73.114 9.705 ms 9.291 ms 9.105 ms
6 * * *
7 * * *
8 * * *
9 * * *
10 * *^C
Click to expand...


Another overseas mail server I manage:
# tcptraceroute mail.XXXXXX.org 25
Selected device eth0, address 10.0.0.250, port 35730 for outgoing packets
Tracing the path to mail.XXXXXX.org (88.84.145.XX) on TCP port 25 (smtp), 30 hop s max
1 10.0.0.2 0.892 ms 0.919 ms 0.852 ms
2 196-210-140-129-rrdg-esr-2.dynamic.isadsl.co.za (196.210.140.129) 7.041 ms 6.081 ms 6.864 ms
3 cdsl2-rba-vl2663.ip.isnet.net (196.38.73.25) 8.843 ms 8.965 ms 8.791 ms
4 cdsl1-rba-vl11.ip.isnet.net (196.38.73.37) 9.340 ms 8.921 ms 9.480 ms
5 196.38.73.86 9.282 ms 9.339 ms 9.412 ms
6 cdsl1-rba-vl58.ip.isnet.net (196.38.73.81) 9.073 ms 8.978 ms 8.687 ms
7 core2b-rba-te2-0-1.ip.isnet.net (168.209.1.182) 9.428 ms 9.375 ms 9.837 m s
8 mi-za-rba-p6-gi2-0-0-304.ip.isnet.net (168.209.164.175) 429.655 ms 429.256 ms 428.898 ms
9 mi-us-25b-p2-gi1-0-4.ip.isnet.net (168.209.160.219) 429.590 ms 429.824 ms 429.053 ms
10 core2a-ny-gi1-0-19-304.ip.isnet.net ...
Click to expand...

If not broken, but deliberate under the circumstances:
http://www.internet.org.za/ect_act...._to_interception_of_or_interference_with_data
 
Having port 587 open on your mail server is actually normal these days. This doesn't mean you should remove port 25, it only means you should open up 587 in addition to 25, so that user's whose ISPs block SMTP can still use your server to send mail via the Submission port (aka 587).
 
http://support.afrihost.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=257&nav=0,55 says:

Are there restrictions on SMTP?

The short answer is: yes.

The following restrictions apply to smtp.afrihost.co.za when you send mail using SMTP:

* Relaying is only allowed from the Afrihost DSL IP range. You cannot use smtp.afrihost.co.za from other providers (e.g. wireless).
* You can only send to a maximum of 100 recipients per mail message. This includes To:, Cc: and Bcc:.
* The size limitation is 102.4 Mega Bytes per message.
* Every To: or Cc: address in the mail body must be valid
* The sender and recipient domains must be a Fully Qualified Domain Name and must be a valid resolvable DNS domain.
* The sender From: address cannot be free mail services, i.e. Yahoo, Hotmail, GMail, etc are not accepted.
* If your ADSL line operates as an open relay, your access will be blocked.
* Your e-mail address will be blacklisted if you send mail to a spamtrap
* Your e-mail address may be blacklisted if an abuse complaint is received
* No more than 50 recipients per minute, after which you will wait.
* No more than 7 concurrent SMTP connections
* No more than 50 attachments
* Nothing that looks like malware mail is permitted
* Nothing that looks like spam is permitted
Click to expand...
N/A - trying to send another mail servers.

If you send mail directly to another provider, you might be unable to send mail if one of the following happens:

* A machine on your network has triggered the automatic bulk SMTP blocker. This applies to an IP that connects to over 30 machines' SMTP ports in 5 minutes. If this happens to you, run a sniffer like wireshark from http://wireshark.org to see if there is something happening that you don't know about.
NA - Ethereal now Wiireshark has been an old friend of mine, also snoop etc.

* If there is an unresolved SPAM complaint, Afrihost will have filtered your outgoing SMTP. If you resolve the problem, that's great, but do let us know that you would like us to remove the filtering. If you want to be sure that this never affects you, you can use a different port (submission 587/tcp is the official alternative).
No spam complaint
* You have an anti-virus or firewall program which is attempting to send to an incorrect SMTP server, and doesn't realise that the connection has changed.
Nope - multiple systems does it. Good old "telnet smtp-server 25" also blocked on Linux/Solaris.
* There are more than a few paranoid anti-spam systems out there that panic because your ADSL IP address is listed as a spam source, even though you are sending via a relay! The blacklisting is (usually) due to the previous irresponsibility of someone to whom the IP was assigned. Sometimes this is you. When it's not, there is not much we can do about this, because all the mail you send will bear your IP address. The recipient should be able to handle the problem gracefully.
Never had a spam issue. I am also not blocking myself. In fact logs and sniffing on my mails erver shows my port 25 connect never reaches the server.

You can diagnose how far you can get with port 25/tcp using tcptraceroute (linux) or tcptrace from http://tracetcp.sourceforge.net/
Click to expand...
tcptraceroute: See previous post above - who is responsible for the blocking hop?

In a nutshell; trying to blame spam or viruses etc is just a knee jerk reactions at the moment and is not going to fly.

So what is the basis for unfounded blocking of traffic to SMTP port 25 at 196.38.73.114 or cdsl1-rba-vl50.ip.isnet.net = 196.38.73.109? Are the below IPs delegated to Afrihost or is it still with IS?
% Information related to '196.36.0.0 - 196.39.255.255'

inetnum: 196.36.0.0 - 196.39.255.255
netname: ISNET-07
descr: Internet Solutions
descr: The Campus, 57 Sloane Street
descr: Bryanston
descr: Johannesburg
descr: Gauteng
descr: 2021
country: ZA
admin-c: ZT12-AFRINIC
tech-c: ZT12-AFRINIC
org: ORG-TIS1-AFRINIC
status: ALLOCATED PA
mnt-by: AFRINIC-HM-MNT
mnt-lower: TF-ISNET-MNT
remarks: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
source: AFRINIC # Filtered
parent: 196.0.0.0 - 196.255.255.255

organisation: ORG-TIS1-AFRINIC
org-name: Internet Solutions
org-type: LIR
country: ZA
address: The Campus, 57 Sloane Street
address: Bryanston
address: Gauteng
address: Johannesburg 2021
e-mail: [email protected]
phone: +27 11 5750550
fax-no: +27 11 576 0550
admin-c: LS1-AFRINIC
admin-c: ZT12-AFRINIC
tech-c: LS1-AFRINIC
tech-c: ZT12-AFRINIC
mnt-ref: AFRINIC-HM-MNT
mnt-ref: TF-ISNET-MNT
mnt-by: AFRINIC-HM-MNT
remarks: abuse e-mail: <[email protected]>, phone: +27 11 575 0055
source: AFRINIC # Filtered

person: IS Hostmaster
address: The Campus, 57 Sloane Street
address: Bryanston
address: Johannesburg
address: Gauteng
address: 2021
phone: +27(11) 5750550
fax-no: +27(11) 5760550
e-mail: [email protected]
org: ORG-TIS1-AFRINIC
nic-hdl: ZT12-AFRINIC
source: AFRINIC # Filtered
Click to expand...
 
Sollie said:
tcptraceroute: See previous post above - who is responsible for the blocking hop?
Click to expand...
Interesting that you are the ONLY person who seems to be having a problem. Is it perhaps something on the destination network that is broken?
 
These may be obvious but nevertheless here goes;

1. Can you 'telnet localhost 25' on the actual mail server?

2. If you can, then try recreating the dst-nat rules

3. Perhaps get hold of an iburst modem to eliminate the adsl connection
 
Interesting that you are the ONLY person who seems to be having a problem. Is it perhaps something on the destination network that is broken?
Click to expand...
Actually not :) We find other odd posts about this in other places as well, ex: http://forums.pcformat.co.za/viewtopic.php?f=25&t=36257

1. Can you 'telnet localhost 25' on the actual mail server?
Yes, no problems. My issue only arises when I use my Afrihost acct. When using Axxess I can connect through to the mail server ( I am not playing off one against the other).

2. If you can, then try recreating the dst-nat rules
No issues here. Mail server is on a fixed IP.

3. Perhaps get hold of an iburst modem to eliminate the adsl connection.
Erm :erm: ;)

In a nutshell, my diagnosis shows:
From afrihost to mail server: telnet mailserver 25 => fails
All sources, local and international, except from my Afrihost acct: telnet mailserver 25 => okay
SMTP request gets blocked on it's routing from hop 196.38.73.114 to 196.38.73.109 when using my Afrihost acct.


Since I am happy with Afrihost otherwise (except for a small issue I am sure Artur will resolve) and as such would hate this to become a show stopper for me.
 
Seems this is going nowhere and I have lost all patience and tried keeping my cool. I have been accused of spamming and other nefarious activities (utter unsubstantiated BS) and no attempt was made at looking at the issue from a technical perspective.

Unfortunately I am not an IS client, rather an Afrihost client and despite asking who the offending hop belongs to, being willing to take the issue up with them, I have received no answers. Unfortunately it seems Afrihost has an admin at trying to play BOFH.http://en.wikipedia.org/wiki/Bastard_Operator_From_Hell, even threatening to cancel my acct, claiming my mail server is on Spamhaus etc - but Spamhaus shows all is clean. Then he goes on (bold my own)
> What
> will be next?
Being frustrated, the malware which is currently attempting to send spam from
your network will switch to other activity, such as key logging, comment spam
to blogs, facebook hacking, etc.
Click to expand...

> Somebody is actually now sailing close to section 86(2) and 86(5) of the
> ECT ACT of 2002 and it's not me.
We cannot provide you with a legal opinion on the act. However, this section
appears to refer to a person's active interference with content. Mail sent
from compromised systems by botnet operators frequently violates section 45
and 87 of this same act.
Click to expand...
Interestingly that was said without any proof or any checking. I guess that is one way of trying to resolve a technical issue with a n00b. :mad:

I asked for proof of this wild allegation or demanded an apology. None was forthcoming.

Is this ADSL product as good as other ADSL products on the market?
Click to expand...
It could be with a bit of support. Issues will come up from time to time. It is how you deal with issues that differentiates you as a service provider. First trying to deny an issue and when client proves that an issue exists, you attack the client, is no way of dealing with an issue. Examples: Despite Axxess messing up a while ago, they owned up to it. I privately PM'ed them and commended them. Iburst denied real issues many times and eventually lost many clients.

If you cannot even use an email client to connect to your locally hosted mail server using the RFC compliant protocol and your mail server is not blocking it (it never reached the mail server and is dropped in transit on the routing), I would not say it is as good as Axxess, MWeb or any of the other workings solutions. It's a bit like selling a luxury car that fails to start yet you claim it's superior to a clapped out Datsun. So much for the special offer.

This issue was escalated to Gian and other management, but Gian and most of senior management are out of the office. Apart from a promise to look into it by Artur, no answers have been forthcoming. Time goes by ...

With the assistance of another Afrihost client (thank you!) I managed to narrow this down to an issue with the routing and blocking my Afrihost account.

Here is a table of traces highlighting the issue:
http://174.36.167.74/trace.html

1st col: my Afrihost acct hits IP 196.38.73.114 and then drops everything after this hop on an attempt to connect to port 25 on my server. Port 80 etc works fine and allows for a full trace.

2nd col: A friend assisted and with his Afrihost account from my location, he has no issues.

3rd col: From my friend's location, the trace is similar with no issues.

4th col: My Axxess acct shows no issues

5th col: Another location in CT to the server - no issues.

6th col: Another location in JHB to the server - no issues.

It seems this is an issue unique to the IS net on the specific hop. Since I am getting nowhere fast with no Afrihost assistance, is there anybody here who has ideas on how to actually fix this?

I would like to believe this is a glitch and not a deliberate blocking attempt.
 
After the issue headed off into the wrong direction, Arthur from Afrihost brought it back on track.

Thankfully the issue is now resolved.

Thanks Arthur & IS
 
It seems that is an ongoing issue.

I have 7 Afrihost uncapped and capped accounts, and today all of the ip's that i am being assigned are in at least three blacklists.

Perhaps a solution would be to redirect all smtp ports ( 25, 26 and 587 for me) to afrihost Smtp servers. My problem with this is that all mail clients are setup with outgoing authentication, so that they can send from any ISP.
Will the outgoing port redirection work id the clients are setup with the 3rd party mail server credentials ?
 
Hi

I do a lot of work at various sites in Africa for a client where I continuously have problems accessing Afrihost webmail because they block port 2095. Every time I have to get IT to contact the Johannesburg office and sometimes it takes a day or two. Is there any other way I can access Squirrel, Roundcube or Horde without using Port 2095?
 
Tinuva said:
Having port 587 open on your mail server is actually normal these days. This doesn't mean you should remove port 25, it only means you should open up 587 in addition to 25, so that user's whose ISPs block SMTP can still use your server to send mail via the Submission port (aka 587).
Click to expand...

People tend to forget that 587 is the actual SMTP port for sending mail from the client to the server. It's always been there, just not always used. Port 25, however, was (as far memory / my understanding) is that one mail server "talks" to another mail server.

Most ISP's "hijack" port 25 traffic and pushes it through their own servers first, which totally ****s with your own settings, especially if you have your own mail servers
 
AcidRaZor said:
People tend to forget that 587 is the actual SMTP port for sending mail from the client to the server. It's always been there, just not always used. Port 25, however, was (as far memory / my understanding) is that one mail server "talks" to another mail server.

Most ISP's "hijack" port 25 traffic and pushes it through their own servers first, which totally ****s with your own settings, especially if you have your own mail servers
Click to expand...
You are correct when you say port 25 is used between smtp servers, and while it can be used by users, it can be abused by bots, and since ISPs can't prevent users from getting their pcs infected with worms and bots, their only other alternative is to hijack port 25 to help prevent the internet from being infested with spam. I commend ISPs that do this. As long as they only do it for dialup/adsl ect users and not their dedicated server hosting.
 
Chris Botha said:
Hi

I do a lot of work at various sites in Africa for a client where I continuously have problems accessing Afrihost webmail because they block port 2095. Every time I have to get IT to contact the Johannesburg office and sometimes it takes a day or two. Is there any other way I can access Squirrel, Roundcube or Horde without using Port 2095?
Click to expand...

Not sure if I understand the query. To my knowledge, if you're using webmail then it should proxy to Port 80 (HTTP Port) so there shouldn't be an issue.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X